A relative time range is based on the current time, which allows you to search for data that you can run periodically without having to change the query. Relative time is based on the current time. Relative time ranges include "Last 2 hours," "Last 90 days," Last 3 weeks," "Last 18 months," and so on.
It is important to use a relative time range with queries you intend to share. For example, a query based on a calendar date range will fail if other analysts run it after the end of that date range.
This workflow includes the following tasks:
Decide what data you need to collect.
Build the query using a relative time range and criteria that returns relevant data. See Creating a search query .
Run the search. See Run a new search.
You can check the status of the search and watch events being streamed while the search is running. See Review and manage search activity .
Review the search results. See Working with search results.
Save the query so you and others in your environment can access it. See Save a search.
Copy the query in the Search bar to share it with colleagues who work in other environments.